ASN.1 / DER Decoder
Free ASN.1 and DER decoder — paste PEM, base64 or hex and read the tag-length-value tree with byte offsets. Works on certificates, CSRs, private keys, OCSP responses and any DER structure. Decoded locally in WebAssembly.
Runs entirely in your browser — nothing you enter is uploaded or stored.
Reading DER structures
Nearly every artefact in PKI — certificates, CSRs, keys, revocation lists, timestamp tokens — is ASN.1 serialised with the Distinguished Encoding Rules. DER is a tag-length-value format, and it nests: a SEQUENCE contains other elements, which may themselves be sequences. Decoding it is how you answer questions that no higher-level tool exposes, like which exact extension a CA put in an unusual place.
PEM is just base64 around DER
The -----BEGIN CERTIFICATE----- wrapper exists so binary DER can survive email and configuration files. Strip the header, footer and newlines, base64-decode what remains, and you have the DER bytes. That is why this decoder accepts either form — and why a PEM file with the wrong label but valid contents usually still parses.
Offsets
Each node shows where it starts in the byte stream, which is what you need when correlating with xxd output or when a parser elsewhere reports a failure at a position. Turn offsets off for a cleaner read of the structure itself.
Frequently asked questions
What can I paste in?
Anything DER-encoded, in PEM form with the BEGIN/END lines, as bare base64, or as hex. Certificates, CSRs, private and public keys, OCSP responses, PKCS#7 and PKCS#12 structures — they are all ASN.1 underneath, which is why one decoder handles all of them.
What are the tags and lengths?
DER is tag-length-value. The tag says what kind of thing follows (SEQUENCE, INTEGER, OBJECT IDENTIFIER, BIT STRING), the length says how many bytes it occupies, and the value is the content — which for constructed types is more tag-length-value triples. The tree here is that nesting, with each node's byte offset shown so you can correlate it with a hex dump.
Why does my certificate not decode?
Usually the input is BER rather than DER, or it is truncated, or it has been mangled by copy-paste — a missing final newline, or line breaks inserted into the base64. Try re-exporting it. If a structure decodes partway and then stops, the offset of the last successful node tells you where the damage starts.
Is my file uploaded?
No. Decoding happens in a WebAssembly module in this page. That matters here because the natural thing to paste into an ASN.1 decoder is a private key.